NSE7 Practice Test 37 — 15 Questions

Question 1

A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?

Accepted Answer

Traffic from the same source IP arrives on different interfaces for different sessions.. Asymmetric routing occurs when traffic from the same source IP takes different paths through the network, causing packets to arrive on different FortiGate interfaces for different sessions. This breaks stateful inspection because the firewall expects all packets of a session to traverse the same interface; when they don't, it can lead to session timeouts or dropped packets, manifesting as high latency.

Answer

The routing table shows multiple equal-cost paths to the same destination.

Answer

Traffic matching a policy is logged as allowed but the application does not work.

Answer

CPU usage is consistently above 90% during peak hours.

Question 2

A FortiGate is configured to send logs to FortiAnalyzer. The administrator notices that logs are not appearing on FortiAnalyzer. Running 'diagnose log device show' shows 'connected=no'. What is the most likely cause?

Accepted Answer

The FortiGate cannot reach the FortiAnalyzer due to a network issue. The 'diagnose log device show' output showing 'connected=no' indicates that the TCP connection between the FortiGate and FortiAnalyzer (typically on port 514 for syslog or port 514/3000 for FortiAnalyzer protocol) is not established. The most likely cause is a network issue preventing the FortiGate from reaching the FortiAnalyzer, as the connection status is directly tied to Layer 3 reachability and TCP handshake completion.

Answer

The log rate is too high and logs are being dropped

Answer

The FortiGate's log buffer is full

Answer

The FortiAnalyzer license has expired

Question 3

A FortiGate in an HA cluster shows the message 'split-brain detected' in the event log. The administrator checks the HA status and sees both units are in 'standalone' mode. What is the MOST likely cause of this split-brain scenario?

Accepted Answer

The heartbeat interface is down on both units, causing them to assume they are the primary. When the heartbeat interface fails on both units, each FortiGate loses communication with its peer and assumes it is the sole surviving unit. This causes both to transition to 'standalone' mode and operate independently, which is the classic split-brain scenario. The event log message 'split-brain detected' confirms that the cluster has lost heartbeat connectivity, leading to each unit believing it must take over as primary.

Answer

The HA priority is set to the same value on both units

Answer

The HA mode is set to 'active-active' instead of 'active-passive'

Answer

The HA cluster is using a unicast heartbeat and the configuration is incorrect

Question 4

A FortiGate is experiencing high CPU usage due to a large number of sessions. Which TWO actions can the admin take to mitigate the issue? (Choose two.)

Accepted Answer

Set a shorter session TTL for idle sessions to free up resources. Setting a shorter session TTL for idle sessions (Option A) reduces the time inactive sessions remain in the session table, freeing up memory and CPU resources used for session maintenance. This directly addresses high CPU caused by a large number of sessions by accelerating the cleanup of stale entries.

Answer

Increase the session table size

Answer

Upgrade the firmware to the latest version

Answer

Disable all security profiles

Question 5

An administrator configures OSPF on a FortiGate with multiple areas. After configuration, the FortiGate does not become an ABR. What is the most likely reason?

Accepted Answer

There is no interface assigned to area 0. For a FortiGate to function as an OSPF Area Border Router (ABR), it must have at least one interface assigned to the backbone area (area 0) and at least one interface assigned to a non-backbone area. Without an interface in area 0, the FortiGate cannot generate Type 3 summary LSAs or perform inter-area routing, so it remains an internal router. Option D is correct because the absence of an interface in area 0 is the most direct and common reason for a FortiGate not becoming an ABR.

Answer

The router-id is not configured

Answer

The OSPF process is not enabled

Answer

The network type is set to point-to-point

Question 6

A FortiGate is configured with OSPF multi-area. The administrator needs to ensure that routes from area 2 are advertised into area 0. Which TWO configurations are necessary?

Accepted Answer

Configure a virtual-link between area 2 and area 0. To advertise routes from area 2 into area 0, an Area Border Router (ABR) must connect the two areas. The ABR automatically generates Type 3 summary LSAs to propagate routes without explicit redistribution. However, in a multi-area OSPF design, if area 2 is not directly physically connected to backbone area 0, a virtual-link is required to provide logical connectivity. Since the question asks for two necessary configurations and the topology implies a non-direct connection (common in multi-area setups), both an ABR and a virtual-link are needed.

Answer

Set the OSPF network type to point-to-point

Answer

Disable OSPF on area 0

Answer

Enable route redistribution from OSPF into OSPF

Question 7

An administrator is troubleshooting an SD-WAN deployment where traffic from the branch to the datacenter is being sent over the backup LTE link even though the primary MPLS link has low latency and jitter. The SD-WAN rule uses 'Best Quality' strategy with latency and jitter metrics. The performance SLA for MPLS shows 'alive'. Which TWO configurations could cause this behavior?

Accepted Answer

The SD-WAN rule has 'set member' configured to only include LTE.. If the SD-WAN rule uses 'set member' to include only the LTE interface, traffic will be forced over LTE regardless of the performance SLA status or the 'Best Quality' strategy. This overrides the dynamic path selection logic, causing the backup link to be used even when the primary MPLS link is healthy.

Answer

BFD is enabled on MPLS but not on LTE.

Answer

The route to the datacenter is learned via OSPF with a lower cost over LTE.

Answer

The latency threshold is set too low for MPLS.

Question 8

Which FortiClient ATP feature provides protection against zero-day malware by monitoring process behavior and blocking suspicious activities at the endpoint?

Accepted Answer

FortiClient Exploit Prevention. FortiClient Exploit Prevention is correct because it uses real-time behavioral monitoring of process activities—such as API calls, memory access patterns, and code injection attempts—to detect and block zero-day malware that has no known signature. Unlike signature-based detection, this feature identifies malicious behavior at runtime, making it effective against previously unseen threats.

Answer

FortiClient Web Filtering

Answer

FortiClient Cloud Sandbox

Answer

FortiClient Vulnerability Scan

Question 9

An administrator configures a new ADOM in FortiManager for a set of FortiGates. The administrator wants to assign meta fields to devices in this ADOM. Where should the meta fields be defined?

Accepted Answer

Device Manager -> ADOM settings. Meta fields in FortiManager are defined at the ADOM level under Device Manager -> ADOM settings. This ensures that the custom fields are available for all devices within that specific ADOM, allowing consistent metadata assignment across managed FortiGates. Defining them elsewhere, such as in global database objects, would apply them globally rather than per-ADOM, which is not the administrator's intent.

Answer

Policy & Objects -> Object configurations

Answer

System settings -> Admin

Answer

Global database objects

Question 10

In an HA cluster, after a failover, some established sessions are not being synchronized to the new primary unit. Which setting must be enabled to ensure session synchronization?

Accepted Answer

set session-pickup enable. Session-pickup is the FortiGate HA feature that synchronizes the state of established sessions from the primary unit to the backup unit. When a failover occurs, the new primary unit can continue forwarding traffic for those sessions without interruption only if session-pickup is enabled. Without it, all existing sessions are dropped and must be re-established by the clients.

Answer

set override enable

Answer

set sync-sessions enable

Answer

set priority <value>

Question 11

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails to establish phase 2. The phase 2 configuration shows 'set proposal aes128-sha256' on both sides. Which TWO configuration items should the administrator verify?

Accepted Answer

PFS (Perfect Forward Secrecy) settings. PFS ensures that if one session key is compromised, previous and future session keys remain secure by using a Diffie-Hellman exchange in phase 2. If PFS is enabled on one side but not the other, or if the DH groups do not match, phase 2 will fail even when the encryption and authentication proposals are identical. Since the phase 2 proposal 'aes128-sha256' matches on both sides, the mismatch likely lies in PFS settings.

Answer

The local authentication method (certificate vs pre-shared key)

Answer

The encryption algorithm for phase 2

Answer

The pre-shared key

Question 12

An administrator wants to ensure that all traffic from VDOM 'Guest' is logged to a FortiAnalyzer that is managed by FortiManager. What must be configured in FortiManager to achieve this?

Accepted Answer

Configure the VDOM's log settings and assign the device to an ADOM with log forwarding enabled. FortiManager manages log forwarding at the ADOM level. To forward logs from a specific VDOM (Guest) to FortiAnalyzer, the administrator must configure the VDOM's log settings to send logs to FortiAnalyzer and assign the FortiGate to an ADOM that has log forwarding enabled. This ensures that logs from the Guest VDOM are properly forwarded to the FortiAnalyzer managed by FortiManager.

Answer

Enable FortiView on the FortiGate

Answer

Configure a log forwarding policy in the Global ADOM

Answer

Create an automation stitch to forward logs

Question 13

A FortiGate administrator wants to monitor performance thresholds to be alerted when the firewall is under heavy load. Which THREE metrics can be monitored using the built-in performance monitoring features (e.g., 'diagnose sys top' or SNMP)?

Accepted Answer

CPU utilization percentage. The built-in 'diagnose sys top' command and SNMP monitoring both provide real-time CPU utilization percentage, which is a key metric for detecting heavy load on a FortiGate firewall. High CPU usage can indicate resource contention, impacting packet processing and overall performance.

Answer

Interface speed

Answer

Disk space utilization

Question 14

An administrator needs to isolate customer traffic in a FortiGate deployed at a service provider. Each customer should have independent administrators and security policies. Which feature should be used?

Accepted Answer

Virtual domains (VDOMs). Virtual domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own administrators, security policies, routing tables, and interfaces. This is the correct feature for isolating customer traffic at a service provider because it provides complete administrative and policy separation per customer, which VLAN interfaces alone cannot achieve.

Answer

VLAN interfaces

Answer

Policy packages

Answer

Administrative domains (ADOMs)

Question 15

A FortiGate admin configures an automation stitch to send an email alert when a high-severity IPS event occurs. The trigger is 'IPS Event' and the action is 'Email'. After testing, no email is sent despite events being logged. What is the most likely cause?

Accepted Answer

No SMTP server is configured in the FortiGate. The automation stitch requires a functional SMTP server configuration to send emails. Without an SMTP server defined under System > Settings > Email Service, the FortiGate cannot relay the alert email, even if the trigger and action are correctly configured and events are logged. This is the most common reason for email delivery failure in automation stitches.

Answer

The IPS event severity threshold is set too low

Answer

The automation stitch is disabled

Answer

The IPS engine is in monitor mode